This release includes 3 breaking changes for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
Summary
AI summaryRefactor execution model to use console output instead of return values, removing the module result capture mechanism.
Full changelog
What's Changed
- Add GitHub API token injection tutorial by @r33drichards in https://github.com/r33drichards/mcp-js/pull/64
- Remove snapshot directory by @r33drichards in https://github.com/r33drichards/mcp-js/pull/65
- Add comprehensive end-to-end tests for console.log capture and async execution by @r33drichards in https://github.com/r33drichards/mcp-js/pull/67
- Implement async execution tracking with console output streaming by @r33drichards in https://github.com/r33drichards/mcp-js/pull/66
- Document async execution model and console output features by @r33drichards in https://github.com/r33drichards/mcp-js/pull/68
- Add Docker image for Open Policy Agent server by @r33drichards in https://github.com/r33drichards/mcp-js/pull/69
- Run OPA container with non-root opa user by @r33drichards in https://github.com/r33drichards/mcp-js/pull/71
- Refactor execution model to use console output instead of return values by @r33drichards in https://github.com/r33drichards/mcp-js/pull/72
- Remove module result capture mechanism from ES module execution by @r33drichards in https://github.com/r33drichards/mcp-js/pull/74
- Add ES module import support with esm.sh integration by @r33drichards in https://github.com/r33drichards/mcp-js/pull/75
- Add ES module import support with npm:/jsr:/URL resolution by @r33drichards in https://github.com/r33drichards/mcp-js/pull/70
- Simplify StatelessMcpService to synchronous shell mode by @r33drichards in https://github.com/r33drichards/mcp-js/pull/76
- Remove DEFAULT_HEAP_MEMORY_MAX_MB constant and inline heap limit by @r33drichards in https://github.com/r33drichards/mcp-js/pull/77
- Add external module import policy enforcement via OPA by @r33drichards in https://github.com/r33drichards/mcp-js/pull/78
Full Changelog: https://github.com/r33drichards/mcp-js/compare/v0.3.0...v0.4.0
Breaking Changes
- Removed module result capture mechanism from ES module execution
- Refactored execution model to use console output instead of return values
- Removed DEFAULT_HEAP_MEMORY_MAX_MB constant and inlined heap limit
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About r33drichards/mcp-js
A Javascript code execution sandbox that uses v8 to isolate code to run AI generated javascript locally without fear. Supports heap snapshotting for persistent sessions.
Related context
Related tools
Earlier breaking changes
- v0.11.0 Switch license from ISC to GNU Affero General Public License v3
Beta — feedback welcome: [email protected]